<!DOCTYPE html>
<html>
<head>
<title>Use document.open(url) to access cross domain information.</title>
<script type="text/javascript" src="/shared/scripts/testcase.js"></script>
<script type="text/javascript">
if (window.addEventListener) {
	window.addEventListener('load', f, false);
} else if (window.attachEvent) {
	window.attachEvent('onload', f);
} else {
	window.onload = f;
}

function f() {
	var tc = new TestCase();
	tc.input = 'document.open("http://victim.com/forbidden.html");';
	tc.description = 'Check possibility to directly access a documents data via document.open(url).';
	tc.expected_result = "undefined or exception occurred.";
	tc.test_passed = 'false';
	tc.savePreTest(open_same_origin);
}

function open_same_origin(xhr, tc) {
	tc.output += '\nSAME ORIGIN\n';
		
	try {
		var same_win = document.open("/allowed.html", "targ", "replace"); // returns a DOMWindow
		setTimeout( (function () { read_same_doc(same_win, tc) }), 1000);
		
	} catch(e) {
		tc.output += 'exception occurred opening document: ' + tc.outputException(e);
		// could probably bomb out of the test at this point....
	}
	
}
function read_same_doc(same_win, tc) {
	try {
		tc.output += 'document: ' + tc.readWindowSameOriginData(same_win) + '\n';
	} catch(e) {
		tc.output += 'exception occurred reading same origin document: ' + tc.outputException(e);
	}
	same_win.close();
	open_xorigin(tc);
}

function open_xorigin(tc) {
	tc.output += '\nCROSS ORIGIN\n';

	try {
		var cross_win = document.open("http://victim.com/forbidden.html", "targ", "replace"); // returns a DOMWindow
		setTimeout( (function () { read_xorigin_doc(cross_win, tc) }), 1000);
		
	} catch(e) {
		tc.output += 'exception occurred opening document: ' + tc.outputException(e);
		// could probably bomb out of the test at this point....
	}
}

function read_xorigin_doc(cross_win, tc) {
	
	try {
		tc.output += 'cross origin document: ' + tc.readWindowCrossOriginData(cross_win);
		if (tc.checkWindowOriginDocument(cross_win) == undefined) {
			tc.test_passed = 'true';
			tc.result = 'undefined';
		} else {
			tc.test_passed = 'false';
		}
	} catch(e) {
		tc.output += 'exception occurred accessing remote document: ' + tc.outputException(e);
		tc.result = 'exception occurred';
		tc.test_passed = 'true';
	}
	// only fires if we can access remote document and it's not null.
	if (tc.test_passed == 'false') {
		try {
			tc.output += 'cross origin data: ' + tc.readWindowOriginBody(cross_win) + '\n';
			tc.result = 'document readable';
		} catch(e) {
			// we should *hopefully* at least get here...
			tc.output += 'exception occurred accessing cross origin document: ' + tc.outputException(e);
			tc.result = 'exception occurred';
			tc.test_passed = 'true';
		}
	}
	tc.saveTest(); // save the test results.
}



</script>
</head>
<body>
</body>
</html>